Solved: Blank source and sourcetype?

Jason · ‎06-10-2011

I thought Splunk always assigned a source and at least guessed a sourcetype for ALL data.

Why am I seeing data in Splunk with no source or sourcetype?

Mackenzie · ‎06-10-2011

This can happen when metadata gets corrupted in Splunk. It's related to an issue when using the Delete command. (i've seen this in 4.2). Engineering is aware of the problem and working on a fix.

You can verify this by looking in your indexers splunkd.log for 'safeService' warnings. If you see these, stop splunk and issue:

$SPLUNK_HOME/bin/splunk cmd splunkd fsck --all --mode metadata --repair

This will rebuild your metadata files for each of your indexes. It's similar to the 'recovery' process you see during unclean shutdowns.

View solution in original post

Jason · ‎06-13-2011

Just occasional data. I couldn't discern a specific pattern.

Mackenzie · ‎06-10-2011

This can happen when metadata gets corrupted in Splunk. It's related to an issue when using the Delete command. (i've seen this in 4.2). Engineering is aware of the problem and working on a fix.

You can verify this by looking in your indexers splunkd.log for 'safeService' warnings. If you see these, stop splunk and issue:

$SPLUNK_HOME/bin/splunk cmd splunkd fsck --all --mode metadata --repair

This will rebuild your metadata files for each of your indexes. It's similar to the 'recovery' process you see during unclean shutdowns.

piebob · ‎06-10-2011

can you give some details? what data are you not seeing this for?

Blank source and sourcetype?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation